Introduction
While Communication System-based integration in SAP Sales/Service Cloud Version 2 (for instance with SAP S/4HANA) relies on Basic Authentication or X.509 client certificates for inbound connections, you can use OAuth 2.0 with the Client Credentials grant type for accessing the REST APIs in machine-to-machine scenarios without setting up a communication system. Only a technical user needs to be created.
In this blog, I'll show you how to set up OAuth2 Client Credentials and configure them in two sample clients.
Why OAuth2 Client Credentials?
A high-level comparison with the previously mentioned methods:
- Basic Auth is easy to implement and to use. However, it sends the secret (the password) “unencrypted” to the API endpoint, usually with every call. As long as HTTPS is in use, the connection itself is encrypted at the transport layer. However, if an attacker manages to eavesdrop on the connection (e.g., man-in-the-middle attack), the secret is known and could thus be used for unauthorized access to the target system. For that reason, you should only use it for testing purposes in test environments.
- X.509 Client Certificates offer strong mutual authentication where the secret (in this case the private key) is never transmitted to the recipient. Instead, cryptographic computations on data that changes with every session prove the identity of the server and the client. But this comes with significant operational overhead: certificate issuance, rotation, revocation, and trust store management across every consumer.
- OAuth2 shifts the model: Credentials are exchanged once at a dedicated authorization server, and the resulting short-lived access token is what travels across APIs. That means the secret never reaches the resource server (compared to Basic Auth).
Tokens carry embedded scope and expiry information, and are usually signed (depending on the validation method), which limits the impact if intercepted. Signing and validating tokens happens “behind the scenes” for the caller and keeps this complexity away from them.
The Client Credentials flow is OAuth2 stripped down for machine-to-machine communication: No user context, no browser redirect. Just a system identity authenticating against an authorization server and calling the actual API at the resource server.
Setting Up OAuth2 Client Credentials for REST APIs in SAP Sales/Service Cloud Version 2
1. Create a Technical Role for the API user
If you don't already have a technical role with all required permissions, create a new one:
Go to User Menu –> System Settings –> (Users and Control) –> Roles –> switch the view from Business Roles to Technical Roles
Assign the services that the API user(s), who get this role assigned later, need. You can assign this role to multiple technical users.
Don't forget to Active the role.
2. Create Technical User and assign the Technical Role
Go to User Menu –> System Settings –> (Users and Control) –> Users –> switch the view from Business Users to Technical Users
Create a new technical user using the [+] button. (In contrast to business users, technical users can be created without an employee.)
You don't need to assign a password or upload a certificate for this user. The OAuth settings will be maintained on a different screen. Also, the entered user name will not be used outside of the system. It is just for your reference/to identify it.
Assign the technical role and save the technical user.
3. Open the technical user and Generate Client Credentials
A dialog will be displayed that lets you copy the clientid and the clientsecret.
Please note that the clientsecret will only be displayed once! (see next step)
After initially generating the Client Credentials, you can only view the clientid. You can't view the clientsecret. If you forget the clientsecret, you can only generate a new clientsecret.
After these steps, you can configure clients to use OAuth 2 with the Client Credentials grant type to access SAP Sales and Service Cloud Version 2's REST APIs. Pay attention to additional properties that OAuth2 requires for handing over tokens, etc. I'll mention two examples for common clients in the next section.
Configuring Clients
Bruno API Client
In Bruno, you can set up OAuth 2.0 with the Client Credentials Grant Type on the Auth tab, either for a single request, or for a folder or collection, which allows you to inherit this Auth method to all requests in that folder or collection.
The following screenshot shows the most relevant elements of the Auth tab maintained for a single request that fetches the first 3 accounts from the system.
Maintain the following configuration attributes:
- Access Token URL: https://<<SSCV2_HOST>>/oauth/token
- Client ID: <<your client id>>
- Client Secret: <<your client secret>>
- Add Credentials to: Basic Auth Header
For the Token attributes, I could use the Bruno defaults:
- Token Source: Access Token
- Token ID: credentials
- Add token to: Headers
- Header Prefix: Bearer
After you've maintained all the authentication details, you can click Get Access Token or directly send the request, which fetches the access token on demand.
SAP Integration Suite / Cloud Integration
The second example demonstrates how to call SAP Sales/Service Cloud v2's Accounts REST API (the same service as above in Bruno) from an integration flow (iFlow) in SAP Integration Suite/Cloud Integration using OAuth2 Client Credentials. This requires two steps:
- Create a Security Material
- Use the Security Material in an iFlow
1. Create the Security Material
In SAP Integration Suite, go to Monitor –> Integrations and APIs –> (Manage Security) –> Security Material
If you don't see the Create button on this screen, make sure the Runtime filter is set to All.
Choose Create –> OAuth2 Client Credentials and maintain the following attributes:
- Name: <<credential name as later used in the iflow>>
- Token Service URL: https://<<SSCV2_HOST>>/oauth/token
- Grant Type: Send as Part of Body
- Client ID: <<your client id>>
- Client Secret: <<your client secret>>
- Client Authentication: Send as Request Header
- Content Type: application/x-www-form-urlencoded
The following screenshot shows the Manage Security Material screen. Make sure to adapt the default values of the highlighted fields.
After you have deployed the security material, you can use it in the iFlow.
2. Design the Integration Flow
The sample iFlow only consists of a single HTTP Request-Reply call to the Accounts REST API using the previously created security material. That means, the sample iFlow returns the first 3 accounts from SSCv2 as a JSON body to the iFlow caller.
The important properties can be found in the Connection tab:
- Authentication must be set to OAuth2 Client Credentials
- Credential Name must be set to the name of the previously created security material
(in the sample screenshot below, the name is parameterized to allow users to configure it without editing the iFlow)
I hope this blog was helpful for getting started with OAuth2 Client Credentials in SAP Sales and Service Cloud Version 2.
Source link
